2.6 Explain the security implications of embedded and specialize systems

Question 1

Summarize EMBEDDED SYSTEMS

Answer 1

CompTIA uses the term embedded system more narrowly to describe discrete hardware components that make up portions of systems.

Question 2

Explain the security implications of a RASPBERRY PI

Answer 2

The Raspberry Pi exemplifies the system on chip (SoC) design concept, where all the processing components reside on a single circuit board—that includes CPU, RAM, system BIOS, Ethernet networking, and Wi-Fi networking; plus connectivity points for peripherals such as a keyboard, mouse, and monitor. From a security standpoint, Raspberry Pi systems act, smell, and taste like a typical desktop system, just writ small.

Question 3

Explain the security implications of a FIELD-PROGRAMMABLE GATE ARRAY (FPGA)

Answer 3

An FPGA does not have a fixed CPU, like the Raspberry Pi, but rather has integrated circuits (ICs) that developers can redefine as needed. From a security standpoint, keeping the firmware up to date to work through bugs helps. Plus, limiting physical access to control ports or connections minimizes the potential for an attacker to damage your systems.

Question 4

Explain the security implications of ARDUINO

Answer 4

Arduino products are open source and programmable using the programming languages C and C++. Open source combined with low cost, approachable programming and many connection options have made the Arduino boards the go-to devices at both the professional and enthusiast level for embedded devices. The limited memory on Arduino-based systems leaves them vulnerable to buffer overflow and heap attacks. The systems often connect automatically to the nearest access point when the default connection fails, again providing an opportunity for mischief.

Question 5

Explain the security implications of a SUPERVISORY CONTROL AND DATA ACQUISITION(SCADA)/INDUSTRIAL CONTROL SYSTEM(ICS)

Answer 5

Supervisory control and data acquisition (SCADA) systems are used in industrial applications, such as energy utilities (electric plants, nuclear power plants), production facilities (for logistics and control of manufacturing systems, for example), sewage treatment centers, and other specialized applications. They run TCP/IP protocols and use embedded versions of some of the popular consumer operating systems, such as Windows or Linux. This makes SCADA systems prime targets for hackers, who attack them to damage critical infrastructure, launch denial-of-service (DoS) attacks, and generally create mischief and outright harm. Since SCADA systems often connect to very critical systems, it’s not too hard to imagine a hacker attacking and gaining control of these systems and seriously affecting power, water, and other utilities and services on a massive scale. Methods of mitigating these types of attacks include the traditional ones, such as encryption, authentication, and patch management.

Question 6

Explain the security implications of INTERNET OF THINGS(IoT)

Answer 6

Internet of Things (IoT) describes the many computing devices (other than PCs, routers, and servers) that connect through the Internet, which is about as broad a definition as it gets. As you might imagine, with such incredible diversity of hardware and operating systems, combined with the dizzyingly efficient wireless networking capabilities, IoT security is a nightmare. Most manufacturers of IoT devices in the consumer sphere, for example, err on the side of ease of use for the consumer rather than rigorous security for the power user or IT security specialist.

Question 7

Explain the security implications of WEAK DEFAULTS

Answer 7

Additionally, what IoT devices have in common from a security standpoint are weak default settings. Most manufacturers of IoT devices in the consumer sphere, for example, err on the side of ease of use for the consumer rather than rigorous security for the power user or IT security specialist. Fine-tuning options such as connectivity and notification settings can go a long way toward adding worthwhile security to IoT devices.

Question 8

Explain the security implications of MEDICAL SYSTEMS

Answer 8

The inherent security risks involved with IoMT devices cannot be dismissed. Any device that connects to a network has vulnerabilities and the potential for hacking. A hacked medical lifesaving device could have deadly consequences. So far in the field attacks have been theoretical.

Question 9

Explain the security implications of VEHICLES

Answer 9

From a security perspective, in-vehicle computing systems have some of the same common vulnerabilities that other systems have, which may include network security issues, such as the vulnerabilities inherent to Bluetooth, Wi-Fi, and cellular technologies. There are also issues involving firmware and patch updates to the systems.

Question 10

Explain the security implications of AIRCRAFT

Answer 10

From a security perspective, in-vehicle computing systems have some of the same common vulnerabilities that other systems have, which may include network security issues, such as the vulnerabilities inherent to Bluetooth, Wi-Fi, and cellular technologies. There are also issues involving firmware and patch updates to the systems.

Question 11

Explain the security implications of SMART METERS

Answer 11

Smart meters rely on cellular and wireless networks to communicate to consumers and utility companies real-time information about power usage, usually electricity, but also natural gas or water.

Question 12

Explain the security implications of VOICE OVER IP(VOIP)

Answer 12

Eventually developers came up with Voice over IP (VoIP), a way to do telephony over TCP/IP networks, with no need to use ancient technology. Many (most?) enterprises today have ditched the old PBX telephone systems for modern VoIP systems. You need to secure VoIP communications just like you would any other IP network. Typical VoIP attacks include denial of service, spoofing telephone numbers, and just harassment.

Question 13

Explain the security implications of HEATING, VENTILATION, AIR CONDITIONING(HVAC)

Answer 13

Heating, ventilation, and air conditioning (HVAC) controls also fall into this category and are often automated and connected to the Internet or other networks to monitor and control environmental elements such as temperature and humidity in a facility. This makes SCADA systems prime targets for hackers, who attack them to damage critical infrastructure, launch denial-of-service (DoS) attacks, and generally create mischief and outright harm. Since SCADA systems often connect to very critical systems, it’s not too hard to imagine a hacker attacking and gaining control of these systems and seriously affecting power, water, and other utilities and services on a massive scale.

Question 14

Explain the security implications of DRONES

Answer 14

Your next unmanned aerial vehicle (UAV)—that’s a drone, for all you normal folks—guaranteed will have multiple embedded camera systems, high-end wireless networking capabilities, and an SoC to run them all. From a security perspective, in-vehicle computing systems have some of the same common vulnerabilities that other systems have, which may include network security issues, such as the vulnerabilities inherent to Bluetooth, Wi-Fi, and cellular technologies.

Question 15

Explain the security implications of MULTIFUNTION PRINTER(MFP)

Answer 15

Some devices that might seem an odd fit fall into the IoT category, such as multifunction devices (MFDs) that combine printers, scanners, and copiers into one machine and then add Internet capabilities. As you might imagine, with such incredible diversity of hardware and operating systems, combined with the dizzyingly efficient wireless networking capabilities, IoT security is a nightmare.

Question 16

Explain the security implications of REAL-TIME OPERATING SYSTEM(RTOS)

Answer 16

Embedded systems running on an FPGA tend to run a real-time operating system (RTOS), such as Windows Embedded Compact . An RTOS is designed to respond in real time to inputs. An RTOS is critical for anti-lock brakes, safety stops, and so forth. From a security standpoint, keeping the firmware up to date to work through bugs helps. Plus, limiting physical access to control ports or connections minimizes the potential for an attacker to damage your systems.

Question 17

Explain the security implications of SURVEILLANCE SYSTEMS

Answer 17

The security implications and considerations with modern IoT surveillance systems run from paranoia to downright scary. Ring devices, for example, interface with Amazon Alexa home infotainment devices to send your security footage to “the cloud.” Nothing stops “the cloud” from sharing your footage with local law enforcement or companies that can monetize the information in some other way. Other device manufacturers have been accused of sending personal information gathered from their devices secretly to other nation states.

Question 18

Explain the security implications of SYSTEM ON A CHIP

Answer 18

system on chip (SoC) design concept, where all the processing components reside on a single circuit board—that includes CPU, RAM, system BIOS, Ethernet networking, and Wi-Fi networking; plus connectivity points for peripherals such as a keyboard, mouse, and monitor.

Question 19

Explain the security implications of 5G

Answer 19

5G networks operate at three distinct bands: Low-band, Mid-band, and High-band. The higher the band, the faster the connection speed, but the shorter the range. 5G devices connect automatically at the fastest speed available at range. An attacker has the best potential for success attacking cellular by avoiding cellular altogether. The switch point for devices between cellular and Wi-Fi provides an excellent attack surface because Wi-Fi offers much weaker security than cellular.

Finally, privacy issues should concern users and IT security folks when working with cellular. Turning off geolocation services—where the cellular provider can track your whereabouts at all times—can enhance privacy, although you’ll lose useful functionality.

Question 20

Explain the security implications of NARROW-BAND

Answer 20

Narrowband means NB-IoT uses only a single radio frequency—200 KHz. The goal with NB-IoT is to provide good coverage and devices that don’t need recharging for years.

Question 21

Explain the security implications of BASEBAND RADIO

Answer 21

Part of the underlying physical layer of NB-IoT can rely on devices that use baseband radio processors that manage radio functions from multiple devices. Sounds like a circular definition, but you might see the term on the exam.

Question 22

Explain the security implications of SUBSCRIBER IDENTITY MODULE (SIM) CARDS

Answer 22

Most cellular devices also use a subscriber identity module (SIM) card (Figure 9-13) that stores identity (hence the name) and enables authentication between the device and mobile carriers. All sorts of devices use SIM cards, from smartphones to cameras to wearable IoT devices. SIM cards can still be hacked. lol

Question 23

Explain the security implications of ZIGBEE

Answer 23

Devices and systems that rely on the Zigbee communication protocols offer ad hoc personal area networks that use very low-power radios. This low-bandwidth solution works perfectly for things like medical device data collection and home automation. Zigbee is an open standard, so adoption by manufacturers is increasing. The cost savings provided by the smart IoT systems compared to the older dumb systems in the original buildings will most likely lead to systems upgrades in the near future. Old might be quaint or picturesque, but energy efficiency helps everyone.

Question 24

Explain the security implications of COMPUTING CONSTRAINTS

Answer 24

Embedded and specialized systems come in an astonishing variety, but they have one feature in common: the static nature of their hardware. When you buy a device built around an SoC, for example, you can’t change or upgrade the core computing capabilities of the device. (That’s the compute portion of devices, in industry jargon.) This often means serious resource constraints to favor price over security. Further, manufacturers release devices into the market with the assumption that they’re “place and forget” devices for consumers; in other words, once set up, consumers will assume they’re done configuring or messing with the devices. This leads to a lot of problems, especially when dealing with the flip side of hardware, software.

Question 25

Explain the security implications of NETWORK CONSTRAINTS

Answer 25

Some of these dedicated systems are not always connected to the Internet—a network constraint. In the case of SCADA systems or medical devices, for example, there may be no way to connect them to the Internet without incurring a security risk.

Question 26

Explain the security implications of INABILITY TO PATCH CONSTRAINTS

Question 27

Explain the security implications of AUTHENTICATION CONSTRAINTS

Answer 27

Mobile devices use the same types of authentication systems and technologies that traditional desktops and server systems use. The catch is that they must be compatible with existing authentication systems, such as user name and passwords (including length and complexity requirements), PIN codes, biometrics, and digital certificates.

Question 28

Explain the security implications of COST CONSTRAINTS

Answer 28

That static nature also applies to the security built into the device by the manufacturer, especially when dealing with IoT devices. Competition in the market drives manufacturers to reduce costs or provide low-cost devices for consumers. This often means serious resource constraints to favor price over security.

Question 29

Explain the security implications of IMPLIED TRUST CONSTRAINTS

Answer 29

Implied trust traditionally refers to all the networked computers inside an enterprise or single building. You trust that employees won’t hack each other or do malicious things. You protect against outside threats, but not inside. (This is rapidly changing, as we’ll discuss in a moment.) In practice, this trust model breaks down swiftly because consumers mix and match IoT devices from different vendors all the time. These heterogenous vendor devices often don’t communicate well together straight out of the box. What is the typical consumer’s solution? Lower the security settings that stop the devices from talking amongst themselves. This, as we say in the business, is a bad thing. And at the consumer level, all the security issues outlined previously remain the unfortunate current state of affairs.